Overview

overview

10

Static

static

1

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8c6262f069daf29e9f3b13f128119aa0881ad00f3eaae89527a26b432424a596

  • Size

    544KB

  • Sample

    230323-17lyfsae45

  • MD5

    0560058ae89d06f40a101e2a0ede65ec

  • SHA1

    5f41ce17e95cefda4b8ec2016c0a6fd3664eb478

  • SHA256

    8c6262f069daf29e9f3b13f128119aa0881ad00f3eaae89527a26b432424a596

  • SHA512

    9dba3d148e9d73c8e417b82486c54e8b66d5450968ec896989972f138b83261ca5885c89d5439bd53cdd12dac746bce56ed874dc1712f10bfb02b4b5f9a25559

  • SSDEEP

    12288:DMriy90msxgi94l4ZbpHvMoUgRZpWsvqjT7nN7oqmdcI3zJY4p+F:9yB8GqzRUwvMRErdcAzuF

Score
10/10
redlinedownrealdiscoveryevasioninfostealerpersistencespywarestealertrojan

Malware Config

Extracted

Family

redline

Botnet

down

C2

193.233.20.31:4125

Attributes
  • auth_value

    12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

real

C2

193.233.20.31:4125

Attributes
  • auth_value

    bb22a50228754849387d5f4d1611e71b

Targets

    • Target

      8c6262f069daf29e9f3b13f128119aa0881ad00f3eaae89527a26b432424a596

    • Size

      544KB

    • MD5

      0560058ae89d06f40a101e2a0ede65ec

    • SHA1

      5f41ce17e95cefda4b8ec2016c0a6fd3664eb478

    • SHA256

      8c6262f069daf29e9f3b13f128119aa0881ad00f3eaae89527a26b432424a596

    • SHA512

      9dba3d148e9d73c8e417b82486c54e8b66d5450968ec896989972f138b83261ca5885c89d5439bd53cdd12dac746bce56ed874dc1712f10bfb02b4b5f9a25559

    • SSDEEP

      12288:DMriy90msxgi94l4ZbpHvMoUgRZpWsvqjT7nN7oqmdcI3zJY4p+F:9yB8GqzRUwvMRErdcAzuF

    Score
    10/10
    redlinedownrealdiscoveryevasioninfostealerpersistencespywarestealertrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      evasiontrojan

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

2
T1089

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks